CVE-2026-13514: Exposure of Backup File to an Unauthorized Control Sphere in Chess Play and Learn App
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.
AI Analysis
Technical Summary
This vulnerability affects the Chess Play and Learn App on Android versions 4.9.0 through 4.9.42. It arises from improper handling of the AndroidManifest.xml file component, leading to exposure of a backup file to unauthorized control spheres. Exploitation requires physical access to the device. The vulnerability has been publicly disclosed, and the vendor has confirmed its existence and intends to fix it. However, no official patch or remediation level has been published yet.
Potential Impact
The impact is limited to unauthorized exposure of a backup file on a physical device, which could potentially lead to information disclosure. The CVSS 4.0 base score is 2.4, indicating low severity. There is no indication of remote exploitation or privilege escalation. The vulnerability does not affect cloud services and requires physical access to exploit.
Mitigation Recommendations
No official patch or fix has been published yet. The vendor has confirmed the issue and plans to address it in future updates. Until a fix is released, users should be aware that physical access to the device could expose backup files. The vendor's bug bounty excludes physical-access attacks, but they acknowledge the report and may provide goodwill compensation. Users should monitor vendor advisories for updates and upgrade once a patch becomes available.
CVE-2026-13514: Exposure of Backup File to an Unauthorized Control Sphere in Chess Play and Learn App
Description
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.
CVSS v4.0
Score 2.4low
Affected software
cpe:2.3:a:chess:play_and_learn_app:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Chess Play and Learn App on Android versions 4.9.0 through 4.9.42. It arises from improper handling of the AndroidManifest.xml file component, leading to exposure of a backup file to unauthorized control spheres. Exploitation requires physical access to the device. The vulnerability has been publicly disclosed, and the vendor has confirmed its existence and intends to fix it. However, no official patch or remediation level has been published yet.
Potential Impact
The impact is limited to unauthorized exposure of a backup file on a physical device, which could potentially lead to information disclosure. The CVSS 4.0 base score is 2.4, indicating low severity. There is no indication of remote exploitation or privilege escalation. The vulnerability does not affect cloud services and requires physical access to exploit.
Mitigation Recommendations
No official patch or fix has been published yet. The vendor has confirmed the issue and plans to address it in future updates. Until a fix is released, users should be aware that physical access to the device could expose backup files. The vendor's bug bounty excludes physical-access attacks, but they acknowledge the report and may provide goodwill compensation. Users should monitor vendor advisories for updates and upgrade once a patch becomes available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-28T06:40:38.081Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a41b00927e9c79719ca8384
Added to database: 06/28/2026, 23:36:41 UTC
Last enriched: 06/28/2026, 23:51:26 UTC
Last updated: 08/12/2026, 12:41:08 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.